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ODP 0-386 
31 March 1980 


MEMORANDUM FOR: Deputy Director for Administration 


PROM: Bruce 7, Johnson 
Director of Data Processing 


SUBJECT: Concerns Regarding SAFE 


REFERENCES: A. Memo to DCI fm D/IRO dtd 26 Mar 80, 
subject: Project SAFE (IHC /MM 80-2408 


B. Mena to DCI fm D/opp and D/OCR ata 
26 Mar 80, 8ubjeat: Concerns Regarding 
SAFE. (Opp 0-359) 


STATINTL 1. Attached is & cepy of eae M@MO to the 
DCI (Reference A) commenting on Sues raised by the 
Science and Technology Advisory Pane] (STAP) on pr ct SAFE TL 
(Another copy is coming ta you directly fromp—— f STATIN 


2. I regret to Say that I fing far less Support for 
CSPO than I expected to fing in George's memo. He has indeed, 
Particularly On page 4, said some of the things If thought 
he would Bay, but he precedes thege points with others which, 
I fear, Will augment any existing concerns about the way 
SAFE is being managed, 


as In paragraph 3. manages to convey the idea 
STATINTL that CSPo has been ai laeoly abo changing the SAFE speci- 
fications to include the CLA/DIA link. In fact the amendment 


Tesponse to STAP' gs question 5) and the change hag reached 
them in ample time to be taken into account as the design 

cf SAFE takes Shape. In any @vent, the link Cannot be acti- 
vated until both Organizations have Systems, which ig to Say 
it will be operative no earlier than 1984 when DIA/SAFE 
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made in this paragraph. I do not believe that the Study 
presents as clear a picture of analyste' needs as George 
asserts. He speaks of analysts reqularly accessing SOLIS, 
for example, but the Study merely says that 36% of all the 
analysts interviewed (ineluding CIA analysts in the total 
number) use SOLIS regularly, defining regularly as "at least 
once a month.” When we maet with the Director, OCR will be 
prepared with more information on these claims based on the 
Analysts Support Study. 


5. Perhaps the most troubling statement George makes 
is in paragraph 6, where he says that there has been "no 
extensive formal review or update of CIA's functional require- 
ments." As you learned turing our joint session with Bruce 
Clarke, the review and undating process has been going on 
continuously since the dacision was made to proceed with the 
SAFE Project. George is well aware of this fact and I hope 
to learn from him before our meeting with the Director just 
what he meant by this statement. 


6. The other point which will almost certainly catch 
the Director's eye is the Suggestion in paragraph 7 that he 
task someone to define the security issues inherent in system 
interconnection. Here I am sure George intended to be help- 
ful but he manages again to convey n sense of management 
failure to address these questions. In fact, we are intensely 
aware of the security issyes and expected to address them 
a8 a part of our developing Plans for integrating SAFE into 
the rest of the opp serviees. It is not too soon to begin 
thinking about these problems but neither, in my view, should 
we be accused of being lax. In stating the problem as he 
does, unfortunately, George manages to convey the idea that 
we have indeed been lax. 


7. As you can tell, I am not very happy with the 
"supportive" document from the Director, IRO. Almost cer- 
tainly his comments will somplicate our meeting with the 
Director next Thursday. dowever, no one promised that it 
would be easy to develop the SAFE system. 


STATINTL 
8. You should know that Messra3. Rice, | Clarke 
tf 


and I are meeting on Tuesday afternoon, 1 Ap h 

STATINTL Chairman [fot the STAP. We hope at that meating to 
gain some clarification O= the STAP's stated concerns about 
the Project, I will keep vou advised. 


ae ae /s/ Bruce T. Johnson 
ew Bruce T. Johnson 


ype ye 
PEPE yi n 
j > 


N Me gaghmanta: = eS EE 


ferences 


cc: C/SPS/oOpP 
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The Director of Central Intelligence opp PY ZY 


Washington, D> 20505 


ce Manayement Staff IHC/MM 80-2408 
26 March 1980 


MEMORANDUM FOR: Director of Centra} Intelliaqence 


VIA: Deputy to the NEIL for Resource Management 
FROM: eee eel 

STATINTL Trector, Information Resources Office 
SUBJECT: Project SAFE 
REFERENCE: A. Your memo of 2] March, Subject: Concern 


Regarding SAFE (Tab A) 


STATINTL B. Memo ‘el Chairman, STAP 
to DCI dt T, oUbject: Questions 


Regarding SAFE (Tab B) 


l. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in connection with the SAFE PROJGET.. AS 
background to our comments, i should point out that last year, 
after discussions between the D/DCI/RM, the DDCI, and DDA, it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a Community-wide basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accordance with the above quoted limitations. Conse- 
quently, we are not prepared to comment, except in general terms, 
On many of the concerns raised in the referenced STAP inemorandum. 


2. Of the four principal concerns listed in your memo of 
March 21st, only one falls within the scope of IRO's responsi - 
bility as set forth in paragraph 1 above, namely: 


"What actions are underway to ensure that the Intelli: 
gence Community has access to CIA SAFE and that CIA SAFE 
has access to DIA SAFE as well as such Systems as COINS 
and SOLIS?" 


* 


ace rom DDCI to D/DCI/RM dated 16 March 1979, Subject: Project 
E 


v 
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3. It is appropriate that your concerns along these lines 


be addressed because: 


o At the DCI's semiannual review in May 1979, it was 
stated that a direct physical link between the DIA 
and CIA systems would be provided. ' 


Oo Our review of the current version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA SAFE 
systems is not included in the specifications. 


Oo IJ have discussed this deficiency to the attention of 
the SAFE Project Manaqer and he states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 


4. We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized in the 
SAFE documentation since, if properly specified, it will provide 
the technical capability to enable: 


Oo CIA-analysts to access DIA files. 


© CIA analysts to accass other Community files 
through the DIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 


o OIA analysts to access CIA SAFE files. 


Oo Analyst to analyst communications between DIA 
and CIA analysts. 


Oo The capability to permit other Intelligence 
Community components to access CIA SAFE facilities 
by going through the DIA interfaces with the COINS 
or AUTODIN networks. 

5. It should be noted that the provision of the physical 
links and the technical capabilities to accomplish the above 
listed functions will not, in and of itself, result in the 
implementation of any of these functions. None of the SAFE - 
documentation, either emanating from DIA or CIA, calls for these 
functions to be provided. Indeed, the original CIA SAFE docu- 
mentation specifically provides that the CIA SAFE system will be a 
Closed system accessible only by CIA personnel. The position has 
been taken by some that CIA has no validated requirement for 
access to any non-CIA system, including DIA SAFE. The results of 
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he 1HC-sponsored Analyst Supporti Study indicate that this is 
robably not the case. Nearly hait of the CIA analysts 
interviewed said they regularly access outside data bases such as 
SOLIS, the COINS files, CIRC Il, and the NPIC data system. 
Furthermore, analyst-to-analyst communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requirements for and the value of 
access to external systems should increase still further. 


6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC ) 
which the system is designed to support, it is difficult for those 
charged with designing and implementing the system to anticipate 


what those needs may be. Therefore, we suggest that either you or 


some other appropriate authority should give to the SAFE Project 
Office some appropriate guidance which addresses these areas of 
concern. 


7. We would call to your attention the fact that providing 
any access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 
interpretation of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the responsibility of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, IRO should probably 
be involved in some way since decisions on these issues will’ 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could also 
have a substantial impact on the resources which will be needed to 
satisfy Community ADP requirements. 


8. General comments on other concerns expressed by you based 
upon our limited perspective are: 


z 
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Wwe are informed a | OCR is coordinating 
the CIA user interface wi @ CSPO; that he is 


completely aware of the status of the project and 
consults regularly with the CSPO. 


In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requirements. 


If, in fact, the established lines of communications 
with the users are not adequate, perhaps the reason 

is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 

as it develops. If this is the case, we are not aware 
of it. 


We see no evidence that "major portions of the 
proposed operational capabilities are unspecified." 
It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means. 


The decision to place SAFE on a design-to-cost basis 
necessarily implied some scaling down of the original 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requirements. 


It is our assessment that the CSPO is proceeding with 
development so that NFAC's highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
priority. 


If some of the capabilities which this approach will 
require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 
cation for their inclusion in the initial verston of 
SAFE and the issue should be addressed during program 
review. 


In conclusion, I would take this opportunity to inform 
you of two initiatives we are taking in conjunction with the IHC 
which may have an impact on the future development of SAFE. 


A 
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The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 

We are exploring the possibility that this could 
become the initial step for deveioping user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 

if it i$ ta: succeed. 


o We expect the IHC to recommend tne development 
of a distributed system of bibliographic informa- 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function. 
as. part of an overall Sommunity system. If this 
is to be accomplished, the interconnection of 
the two systems could taken on added importance. 


STATINTL 
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ODP 0-369 
26 March 1980 


MEMORANDUM FOR: Director of Central Intelligence 


VIA: Deputy Director for Administration 
Director, National Foreign Assessment Canter 


ROM: Bruce T. Johnson 
STATINTL Director of Data Processing, DDA 


Clarus W. Rice 
Director of Central Reference, NFAC 


SUBJECT: Concerns Regarding SAFE 


REFERENCE: Your memo dtd 21 March 1980, same subject 
(ExReg 80-754/1) 


1. This memorandum resrends to your query of 21 March 
1980, transmitting some questions about SAFE posed by your 
Science and Technology Advisory Panel (STAP)., 


2. Attached ara answers to the spbGific questions 
xaised by the STAP, presented in a narrative form reflect- 
ing the complexity of some of the issues they addressed. 
These answers represent the ccordinated views of OCR and 
ODP, reviewed and endorsed by the DDA and the Director, NPAC. 


3. At our meeting with you, now scheduled for 3 April, 
STATINTL¥@® propose that ee Director of the Con- 

“solidated SAFE Project Office (CSPO), present a brief 
Summary which addresses the fegr concerns you list in your 
memorandum, after which we will be prepared to elaborate 88 CTATINTL 
any of those or other STAP stions about SAFE. Wa wiil 
also have available dr. (saeaeeneeeT) Chief of OCR's Systexs 
Analysis Staff, to discuas 8 extensive efforts to iden~ 
tify user requirements. 


TATINTL 
4. We understand that Mesars. 
will be at the meeting, and welcome Oppo y to 


zr 
discuss their questions with them. We would like to suggest, 
howaver, that it may be profitable for us to spend some 
additional time with them subsequent to our joint meating 
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SUBJECT: Concerns Regarding SAFE 


with you, to supplement the ona short briefing previously 
provided for them by SAFE's managers. 


/s? Bruce T. Johnson 


“Bruce T. son 
STATINTL 

Clarus W. ce 
CONCUR: 
Deputy Director for Administration Date 

STATINTL _ 
26 MAR 1980 

Director, National Foreign Assassment Center Date 


Attachments: a/s 
ce: D/CSPO 
0/D/ODP /BJohnson:ee/ 3-26-80 


Distribution: 
Orig - DCI w/fatt. (ave des Cnty Gnn } 
~- DDCI w/att. (c/o Aatethe ten Bix Logan J 5 
Exec. Reg. w/att. 
D/NFAC w/att. 
.DDA w/att. 
D/CSPO w/att. 
D/OCR w/att 
ODP Registry w/o att. 
O/D/ODP w/att. 


tN HR RB 
peteereae 
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21 March 1980 


MEMORANDUM FOR: Deputy Director for National Foreign Assessment 
Deputy Director for Administration 
Director of Data Processing 


FROM: Director of Central Intelligence 
SUBJECT: Concerns Regarding SAFE 


1. One of the subjects addressed at the recent Science and 
Technology Advisory Panel (STAP) meeting was the SAFE system and 
its implementation. Several concerns were expressed at the meeting 
regarding SAFE, including the fact that there are no plans at present 


to connect CIA and DIA SAFE systems so that they are mutually accessible. 


I share several of the.concerns expressed by the Science and Technology 
Advisory Panel, and accordingly would like to meet with you to address 
several of the issues that were raised by the Panel. I attach for your 
information and response a list of questions and concerns prepared by 
the STAP relating to SAFE. While I would appreciate your being prepared 
to address all of these questions at our meeting, I personally am 
especially concernéd about the following: 


~- What actions are under way to ensure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access to 
DIA SAFE as well as such systems as COINS and SOLIS? 


-- How will SAFE deal with open source material? 

-- As described in some detail on page 3 of the STAP paper, 
what actions are being taken to identify the real needs of the 
SAFE user community and will they be satisfied by the system? 

-- How can CIA make a reasonable evaluation of the current 
status of SAFE with major portions of the proposed operational 


capabilities either unspecified or not communicated to the 
Agency? : 
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2. Iwill schedule a meeting to discuss these issues toward the 
end of next week. In the meantime, I would appreciate your responding 
to all of the questions in the attached paper and providing such responses 
to me by the middle of next week for my use in preparation for the meeting. 


STATINTL 
STANSFIELD TURNE 
Attachment a/s 
cc: DODCI 
DDS&T 
2 
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| D/ODP/DDA 
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SUBJECT: (Optional) 


Concerns Regarding SAFE ah. 


‘FROM: | EXTENSION [ NO. 


31 March 1980 


TO: (Officer designation, room number, ond 
building) OFFICER'S COMMENTS (Number each comment to show from whom 


INITIALS to whom. Draw a line across column after each comment.) 


DDA, 7D-24, Ha. meee 
: 2 tne pices As this memorandum was 
2. coming off the typewriter, 
called to tell 
a STATINTL. that he had just met with 
: | and had shown 
STATINTL im our joint memorandum to 
ee | -~----ythe Director. [_ |said 
: S ATINTLthat he can support everything 
that we said in that memoran- 
ee ee gp ete {dum. 
5. 
| With reference to para. 
es pe es oa + o---15 of my attached memo, when 
* | George spoke of updating 
| | |functional requirements he 
a - : | j “~~ }really meant that there was a 
7. need to investigate anew the 
| ‘requirements which CIA and 
~~ - SEE Gael Tee ~~---iDIA analysts might have which 
. | | would exploit a link connect- 
| ling the SAFE systems in the 
—o — ears e -~-——itwo organizations. I must 
: ‘confess that I could wish that, 
i if that was his intention, he 
SE —~ mn pens sp = =F had found a clearer expressio 
Ve | for it. 
! : 
no! ee | eee 
| | Bruce T. Johnson 
, ae — i ae | 
$—————4- | -f-+] 
i | | — 
va : _ ; | _ 
| | | : 
1 + ee eer | ae 
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